Atomic Edge analysis of CVE-2026-22850:
This vulnerability is an unauthenticated SQL injection in the Koko Analytics WordPress plugin, affecting versions up to and including 2.1.2. The flaw resides in the data import functionality, allowing attackers to execute arbitrary SQL commands. The CVSS score of 7.5 indicates a high-severity issue.

The root cause is insufficient input validation in the `import` function within `/koko-analytics/src/Admin/Data_Import.php`. The function processes SQL statements from an uploaded file without proper sanitization. The vulnerable code at line 75 executes `$wpdb->query($statement)` directly on user-controlled SQL statements. The plugin fails to restrict these statements to safe tables, allowing arbitrary database operations.

Exploitation requires an attacker to craft a malicious SQL file and upload it via the plugin’s data import feature. The attack vector is the `/wp-admin/admin.php?page=koko-analytics-import-export` endpoint, which handles file uploads for data import. An attacker would submit a POST request with a file containing SQL injection payloads. The payloads can target any database table, not just the Koko Analytics tables, enabling data extraction or modification.

The patch adds a validation check before executing SQL statements. The updated code at lines 75-77 in `Data_Import.php` inserts a regular expression check: `if (! preg_match(“/{$wpdb->options}|{$wpdb->prefix}koko_analytics/”, $statement))`. This restricts executed statements to only the WordPress options table or Koko Analytics tables. The patch prevents execution of SQL targeting unauthorized tables, effectively neutralizing the injection vector.

Successful exploitation allows complete compromise of the WordPress database. Attackers can extract sensitive information including user credentials, personal data, and plugin settings. They can also modify or delete data, potentially leading to site takeover. The unauthenticated nature of the attack significantly lowers the barrier for exploitation, making any site running the vulnerable plugin an immediate target.